Casual observers might be surprised to learn that shares of Mastercard, which most people associate with the humdrum business of charging merchants for credit card swipes, are soaring. Last week, the card giant’s stock hit an all-time high of $575, and many analysts predict it will keep climbing—not least because Mastercard recently forecast compound annual growth of 12% to 14% for the next three years.

Is this due to consumers charging up a storm? Not exactly. While an uptick in transactions is certainly helping the company’s growth story, the real growth story lies in Mastercard’s recent embrace of services, which now make up 40% of the company’s revenue.

In an interview with Fortune, Mastercard CFO Sachin Mehra described the company’s current strategy as a “virtuous cycle” where network transactions supply valuable data that it can use to build add-on services for things like cybersecurity and targeted marketing. Meanwhile, Mehra added, the company’s growing prowess in AI—which is primarily built in-house—is rapidly improving both sides of the business.

In any event, investors appear to like what the company is doing as Mastercard’s current 12-month return is around 32.3%, significantly outpacing the S&P index figure of 26.4% for the same period. This suggests many regard Mastercard as a growth play—especially considering the company’s modest annual 0.55% dividend payout.

Mastercard’s performance is also notable given the relatively feeble showing of many of its industry peers. The chart below shows its relative three-year performance compared to a financial subset of the S&P index:

The massive discrepancy shown in the chart can be explained in part by the sub-index's inclusion of a group of regional banks whose shares got hammered amid a crisis in the sector caused by rising interest rates. It should also be noted that Mastercard's main competitor, Visa, also outperformed the overall S&P and that both companies could face pressure due to Capital One's acquisition of Discover and its network.

Mastercard, though, has leaned into the fast-growing services segment to a greater degree than either of its competitors, and according to Mehra, that strategy is poised to reap outsize benefits in coming years.

AI and the coming fraud battle

When Mastercard spent $2.65 billion last year to purchase Recorded Future—a firm that specializes in exposing overseas hacking threats—it underscored how cybersecurity has become a key component of the card giant's strategic and business plans.

The Recorded Future acquisition only closed in late December, meaning it made a minimal contribution to Mastercard's latest earnings, but it will likely provide a significant revenue boost going forward. The company did not provide a granular breakdown of the money it is making from services, but based on comments from Mehra and other executives, it's clear cybersecurity contributes to a big portion of that.

In practice, Mastercard's cyber business comes in the form of selling advanced fraud detection services to merchants that help them decide how to best establish a trade-off between reducing transaction friction and screening for bad actors. This process is complemented by the company's push to expand tokenization, a process that replaces card numbers—which can be intercepted and stolen—with a more generic identifier.

In coming years, however, credit card networks are likely to be tested like never before as fraud rings—many of them seasoned criminal hackers from Russia and China—use generative AI tools to create deepfakes and other forms of advanced impersonation. Mehra, though, says Mastercard is ready for the new threat, in part because AI is not just a tool for attackers, but for companies to harden their defenses.

He explained that, both for cybersecurity and the company's operations in general, Mastercard has a sophisticated AI strategy, that has been helped by its 2017 acquisition of Brighterion, a San Francisco artificial intelligence startup. That strategy is formed by a three-part framework that informs the use of AI.

"Just having the data is insufficient... You've got to be able to organize the data in a manner which allows for those models to be effective," said Mehra. "Step one, you've got to have the data. Step two, you have to structure the data and organize it in a manner which can make your models effective. Step three is about having the right kind of data scientists and AI folks to actually create models which are self-learning models which help to improve the efficacy."

When it comes to the coming generative AI clash between cyber attackers and Mastercard, only time will tell who has the upper hand. In the meantime, the company is also using AI to soup up its other service offerings, which include data-based marketing services that it provides to large customers like Starbucks that are looking to improve their ad targeting online and in the real world.